Text Exploits
31,343 exploits tracked across all sources.
Company Visitor Management System (CVMS) 1.0 - Authentication Bypass
by Oğuz Türkgenç
Simple Grocery Store Sales AND Invent... - SQL Injection
An issue was discovered in SourceCodester Simple Grocery Store Sales And Inventory System 1.0. There was authentication bypass in web login functionality allows an attacker to gain client privileges via SQL injection in sales_inventory/login.php.
by Saurav Shukla
CVSS 9.8
Vehicle Parking Management System 1.0 - Authentication Bypass
by BKpatron
berliCRM 1.0.24 - SQL Injection
berliCRM 1.0.24 contains a SQL injection vulnerability in the 'src_record' parameter that allows remote attackers to manipulate database queries. Attackers can inject malicious SQL code through a crafted POST request to the index.php endpoint to potentially extract or modify database information.
by Ahmet Ümit BAYRAM
CVSS 8.2
Battle.Net 1.27.1.12428 - Insecure File Permissions
by George Tsimpidas
Liman 0.7 - CSRF
Liman 0.7 contains a cross-site request forgery vulnerability that allows attackers to manipulate user account settings without proper request validation. Attackers can craft malicious HTML forms to change user passwords or modify account information by tricking logged-in users into submitting unauthorized requests.
by George Tsimpidas
CVSS 5.3
Online Students Management System 1.0 - 'username' SQL Injections
by George Tsimpidas
Cisco ASA/FTD - Path Traversal
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system. The vulnerability is due to a lack of proper input validation of URLs in HTTP requests processed by an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device. The web services file system is enabled when the affected device is configured with either WebVPN or AnyConnect features. This vulnerability cannot be used to obtain access to ASA or FTD system files or underlying operating system (OS) files.
by 3ndG4me
CVSS 7.5
openMAINT <1.1-2.4.2 - Command Injection
openMAINT before 1.1-2.4.2 allows remote authenticated users to run arbitrary JSP code on the underlying web server.
by mrb3n
CVSS 8.8
DynPG 4.9.1 - XSS
Cross Site Scripting (XSS) vulnerability in DynPG 4.9.1, allows authenticated attackers to execute arbitrary code via the groupname.
by Enes Özeser
CVSS 5.4
Kentico <12.0.50 - XSS
Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, leading to XSS.
by Ataberk YAVUZER
CVSS 5.4
D-Link DSR-250N <3.17B - DoS
An issue was discovered on D-Link DSR-250N before 3.17B devices. The CGI script upgradeStatusReboot.cgi can be accessed without authentication. Any access reboots the device, rendering it therefore unusable for several minutes.
by RedTeam Pentesting GmbH
CVSS 5.5
BACnet Test Server <=1.01 - DoS
BACnet Test Server versions up to and including 1.01 contains a remote denial of service vulnerability in its BACnet/IP BVLC packet handling. The server fails to properly validate the BVLC Length field in incoming UDP BVLC frames on the default BACnet port (47808/udp). A remote unauthenticated attacker can send a malformed BVLC Length value to trigger an access violation and crash the application, resulting in a denial of service.
by LiquidWorm
Textpattern CMS 4.6.2 - 'body' Persistent Cross-Site Scripting
by Alperen Ergel
Karel IP1211 - Path Traversal
A path traversal vulnerability exists in the Karel IP1211 IP Phone's web management panel. The /cgi-bin/cgiServer.exx endpoint fails to properly sanitize user input to the page parameter, allowing remote authenticated attackers to access arbitrary files on the underlying system by using crafted path traversal sequences. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.
by berat isler
EasyPMS 1.0.0 - Auth Bypass
EasyPMS 1.0.0 contains an authentication bypass vulnerability that allows unprivileged users to manipulate SQL queries in JSON requests to access admin user information. Attackers can exploit weak input validation by injecting single quotes in ID parameters and modify admin user passwords without proper token authentication.
by Jok3r
CVSS 7.5
Typesetter CMS <5.1 - XSS
Typesetter CMS 5.x through 5.1 allows admins to conduct Site Title persistent XSS attacks via an Admin/Configuration URI. NOTE: the significance of this report is disputed because "admins are considered trustworthy.
by Alperen Ergel
CVSS 4.8
Get-simple Getsimple Cms - XSS
GetSimple CMS 3.3.16 allows in parameter 'permalink' on the Settings page persistent Cross Site Scripting which is executed when you create and open a new page
by Roel van Beurden
CVSS 5.4
Cmsmadesimple Cms Made Simple - XSS
CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website.
by Roel van Beurden
CVSS 5.4
By Source